Malwagon
EXE
EvoVisLauncher.exe File Analysis · first seen Oct 13, 2026 18:08 · 74.5 MB
1proc 300files 22reg 100drops 103IOCs
Malicious71 Completed Public
Get sample Report Sign in

EvoVisLauncher.exePE analysis report - Malicious

Run integrity

sample ran

The guest staged the sample and launched it, so what follows describes this file rather than an empty desktop.

44.0sto launch
1075telemetry events
477observed
60agent notes

Malicious

71/100

1 point past the malicious line at 70.

Clean0-34 Suspicious35-69 Malicious70-100

Why this verdict

+40
Static analysis
  • 2 suspicious signature match(es)
  • Anti-debug API name(s) IsDebuggerPresent, OutputDebugString: ONE observation read by two static sources, not two findings - signature Suspicious_Anti_Debug_API matched them in the file and the Anti-debugging capability bucket read the same names from the import table; both charges kept.
  • 3 high-risk capability bucket(s): Privilege escalation, Process injection, Anti-debugging
  • Malicious strings: injection / execution
+17
Runtime behavior
  • 1 evasion behavior(s)
  • Dropped an executable to disk
+14
Network resolution
    +0
    Persistence
    • 1 persistence mechanism(s): .NET Startup Hook DLL
    • 3 point(s) are not charged here: .NET Startup Hook DLL is named in this file's strings and not established at run time, so the reference is published and not scored.
    +0
    Model review
    • findings review (advisory, not scored): suspicious - mass dropped executables, delivery domain iocs, host fingerprint registry writes, wdigest key created

    Model reading

    Measured MALICIOUS71 of 100

    Evidence ledger above, row by row. Published verdict rests on this column and on nothing to its right.

    Model reads it asadvisory, no points NOT ASSESSEDnot shown on this page

    Reads this report's derived findings, never the sample itself.

    A model reading exists for this scan and is shown to the submitter and to staff only. It is a second opinion about evidence the score already priced, it is worth no points, and on a public page it would stand beside the verdict with no grounding a stranger could check.

    Other high-severity findings
    • HIGH APC injection primitive (QueueUserAPC)
    • HIGH Early-bird / QueueUserAPC on suspended process
    • HIGH Injection/execution API strings
    • HIGH Thread-context hijack injection (SetThreadContext)

    Analysis layers

    Static ran moved the score
    Dynamic ran moved the score
    Threat intel local feeds only no points
    AI not included

    Sample

    TypeFile
    MIMEapplication/vnd.microsoft.portable-executable

    Run conditions

    Sandbox OSWindows 10
    EnvironmentWorkgroup
    InternetIsolated
    Execution165s
    Guest hardware2 vCPU4095 MB RAM

    Detection signatures

    26 detected · 9 withheld as common
    Severity Detection Evidence Layer
    HIGH
    AMSI tamper pattern (LoadLibrary amsi + GetProcAddress)
    MITRE T1562.001
    string amsi found in the sample's strings
    import kernel32.dll!GetProcAddress requires getprocaddress
    		static
    HIGH
    APC injection primitive (QueueUserAPC)
    MITRE T1055.004
    import kernel32.dll!QueueUserAPC
    		static
    HIGH
    Early-bird / QueueUserAPC on suspended process
    MITRE T1055.004
    import kernel32.dll!QueueUserAPC requires queueuserapc
    import kernel32.dll!ResumeThread requires resumethread
    		static
    HIGH
    Injection/execution API strings
    MITRE T1055
    string amsi.dll matched string
    		static
    HIGH
    Thread-context hijack injection (SetThreadContext)
    MITRE T1055.003
    import kernel32.dll!SetThreadContext requires setthreadcontext
    import kernel32.dll!GetThreadContext requires getthreadcontext
    		static
    MED
    Creates a suspended process then resumes (hollowing/hijack)
    MITRE T1055.012
    import kernel32.dll!CreateProcessW requires createprocess
    import kernel32.dll!ResumeThread requires resumethread
    		static
    MED
    Dropped an executable to disk
    MITRE T1105
    file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\es\PresentationFramework.resources.dll dropped
    file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\es\PresentationCore.resources.dll dropped
    file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\WindowsBase.resources.dll dropped
    file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\UIAutomationTypes.resources.dll dropped
    		dynamic
    MED
    Evasion: sleep
    MITRE T1497
    runtime sleep evasion signal
    		dynamic
    MED
    Exception-based anti-debug (SEH/VEH install)
    MITRE T1622
    import kernel32.dll!AddVectoredExceptionHandler
    		static
    MED
    Executes external code / commands
    MITRE T1059
    confirmed at runtime, seen in 30% of benign software statically
    capability createprocessw capability: execution
    capability createthread capability: execution
    capability shellexecutew capability: execution
    		static
    MED
    High file entropy (encrypted/compressed payload)
    MITRE T1027
    entropy 7.93 threshold 7.20, maximum 8.00
    		static
    MED
    Opens/suspends remote threads
    MITRE T1055
    import advapi32.dll!OpenThreadToken requires openthread
    import kernel32.dll!SuspendThread requires suspendthread
    		static
    MED
    TLS callback (pre-main execution)
    MITRE T1055
    pe_header IMAGE_DIRECTORY_ENTRY_TLS present callbacks run before the entry point
    		static
    LOW
    Adjusts token privileges (SeDebug / escalation)
    MITRE T1134
    seen in 8% of benign software
    import advapi32.dll!AdjustTokenPrivileges
    		static
    LOW
    Checks for WOW64 (bitness/anti-analysis)
    MITRE T1497
    seen in 9% of benign software
    import kernel32.dll!IsWow64Process
    		static
    LOW
    Checks system uptime (sandbox age check)
    MITRE T1497.001
    seen in 12% of benign software
    import kernel32.dll!GetTickCount64
    		static
    LOW
    Direct memory execution (VirtualProtect + memory copy)
    MITRE T1055
    seen in 9% of benign software
    import kernel32.dll!VirtualProtect requires virtualprotect
    import kernel32.dll!VirtualAlloc requires virtualalloc
    		static
    LOW
    Drops + executes from temp (GetTempPath + CreateProcess)
    MITRE T1204
    seen in 7% of benign software
    import kernel32.dll!GetTempPathW requires gettemppath
    import kernel32.dll!CreateProcessW requires createprocess
    		static
    LOW
    Duplicates a process handle (handle theft)
    MITRE T1134
    seen in 10% of benign software
    import kernel32.dll!DuplicateHandle
    		static
    LOW
    Executes via ShellExecute
    MITRE T1204
    seen in 12% of benign software
    import shell32.dll!ShellExecuteW
    		static
    LOW
    Opens a device via CreateFile (driver/raw IO)
    MITRE T1106
    seen in 6% of benign software
    import kernel32.dll!CreateFileA requires createfile
    string \\.\ found in the sample's strings
    		static
    LOW
    Process-injection capability
    MITRE T1055
    seen in 5% of benign software
    capability getthreadcontext capability: injection
    capability queueuserapc capability: injection
    capability setthreadcontext capability: injection
    		static
    LOW
    Reflective/manual DLL load pattern
    MITRE T1620
    seen in 8% of benign software
    import kernel32.dll!VirtualAlloc requires virtualalloc
    import kernel32.dll!GetProcAddress requires getprocaddress
    import kernel32.dll!LoadLibraryA requires loadlibrary
    import kernel32.dll!CreateThread requires createthread
    		static
    LOW
    Sleep-based sandbox evasion
    MITRE T1497.003
    import kernel32.dll!SleepEx
    		static
    LOW
    Spawns child processes
    MITRE T1106
    seen in 16% of benign software
    import kernel32.dll!CreateProcessW
    		static
    INFO
    Stages in the temp directory (GetTempPath)
    MITRE T1074
    seen in 15% of benign software
    import kernel32.dll!GetTempPathW
    		static
    Withheld: 9 rules fired and were not reported above

    These rules matched this sample, and they also match this much of known-clean software (measured over 1145 signed Windows and third-party binaries). A rule that fires on most clean files cannot move a verdict, so it is held back unless the detonation confirms the behaviour. They are listed because a count that shrinks without saying so is not a count an analyst can check.

    Timing-based anti-analysis (QueryPerformanceCounter/rdtsc) fires on 92% of benign software
    Anti-debugging capability fires on 65% of benign software
    Dynamic API resolution (obfuscation) fires on 65% of benign software
    Anti-debug: checks for a debugger fires on 60% of benign software
    Resolves APIs dynamically (LoadLibrary + GetProcAddress) fires on 49% of benign software
    Anti-debug via OutputDebugString probe fires on 41% of benign software
    Creates a named mutex (single-instance / infection marker) fires on 31% of benign software
    Queries system information (host recon) fires on 25% of benign software
    Enumerates files recursively (staging/collection) fires on 21% of benign software

    Persistence

    1 mechanism
    LOW
    .NET Startup Hook DLL static
    DLL Load Order · MITRE T1574

    Auto-start methods established during detonation or referenced statically. The Persistence tab lists these against every method checked.

    What the tests returned

    7 tests

    Each test this run performed and what it returned. A test that was not performed says so rather than reading as a negative result.

    TestResult
    Persistence mechanismsnone established at runtime
    Cross-process injectionnone observed
    Network connectionsthe capture came up and attributed no outbound connection; this run had no route out, so none could have succeeded in any case
    Behavioural rule matches (Sigma)none observed
    Known-malicious hash (reputation sources)no source reported this file
    Local anti-virus enginereported no detection
    Capability analysis of the file's codenot checked - the check ran past its time limit and was stopped

    Absence of an observation is not proof of absence - see Coverage for what this run could and could not test.

    Arguing against malice

    • The local anti-virus engine reported no detection.
    • No reputation source reported this file as malicious.

    How much weight this carries

    Observed. Observed at runtime and attributed to this sample by one layer. The one fact that decided it: payload written to disk.

    Instrument coverage

    1 of 2 measured

    What this run was able to observe, as the run itself recorded it. A layer that did not run makes an empty result a fact about the sandbox rather than about the sample.

    LayerRanWhat that means
    Runtime anti-analysis watch measured Measured. The in-process hook group for debugger, timing and hypervisor checks armed on this run, so an empty signal list means something looked and saw nothing.
    Network capture not on this plan Not included on this scan's plan.
    Live kernel introspection not measured Not measured. This run did not ask for the memory-dump option, which is what starts the introspection loop.

    This lists the layers this run recorded for itself. A layer that is not listed was not recorded either way, so its absence here is not a result.

    Structure

    What the file is made of: headers, imports, how it was built and whether it was signed.

    Signature
    Microsoft Visual C/C++(19.36.35223)[LTCG/C++]
    Not packed Unsigned
    CompilerMicrosoft Visual C/C++(19.36.35223)[LTCG/C++]
    LinkerMicrosoft Linker(14.36.35223)
    Library.NET Core(Loader)
    Identity
    File
    typeexecutable
    size74.5 MB
    file arch64-bit (x64)
    subsystemGUI
    entropy7.9323
    date2026-07-18 00:07:23 UTC
    version1.1.41.0
    descriptionEvoVisLauncher
    productEvoVisLauncher
    original nameEvoVisLauncher.dll
    languageNEU

    Antivirus engine

    no signature matched signature set 28152 - 3.6M signatures

    Nothing in the signature set below matched this file. That is one engine's negative answer against one signature set on one day, and it is not a verdict. A signature engine only recognises what has already been named and published, so a file nobody has named yet scans exactly like a file that is harmless. What this file does when it runs is the stronger evidence; read the behaviour sections for that.

    Signature setValue
    Set version28152
    Signatures in the set3,642,870
    Set published13 Oct 2026 06:26 +0000
    Age when this file was scannedsame day

    A negative answer is only as good as the signature set that gave it, so the set is recorded with the result and the result can be reproduced against it.

    Local ML assessment

    no model score

    No model score exists for this file: the file is larger than the 32 MB the local model is allowed to read in one scan, so it got a static heuristic instead. That is a gap in coverage and not a finding - the absence of a score here says nothing about the file.

    Structural rules of thumb, not a model. 3 cheap static signals fired, for 45 of 100 on a rule-of-thumb scale that is deliberately left out of the verdict score: the packing, entropy and signing cards on this report already price the same facts, and counting them a second time under a machine-learning heading would charge one piece of evidence twice.

    • high entropy 7.9323
    • unsigned executable
    • TLS callback
    Packing
    Not packed
    This file's code is readable on disk - nothing is compressed or encrypted around it.
    30/100
    packer confidence
    Static analysis reads this file directly Nothing is hiding the code from a static pass, so what the file contains is what the report shows.
    Indicators weighed 4 signals
    • Non-standard section names: .CLR_UEF, Section
    • High-entropy overlay (7.99, 67916343 bytes)
    • Embedded executable in resources
    • TLS callback present

    Family configuration search

    Not attempted

    The sample is 74.5 MB and the config parser pass is bounded at 16.0 MB, so no family parser was run against it - a family configuration may exist in this file and was not looked for. The absence of an extracted configuration is therefore not evidence about this sample.

    Sample size74.5 MB
    Bound16.0 MB
    Limit reachedSample size, before any parser was loaded.

    Secrets & malicious strings

    1 flagged string

    Flagged string categories

    injection / execution high 1 hit
    IndicatorFound inEvidence from the sample
    amsi.dll raw bytes present in the file bytes only

    Capabilities

    8 behaviour buckets · 3 high-risk
    SeverityCapabilityMITREAPIs
    high Privilege escalation
    Adjusts tokens / privileges
    		 T1134, T1134.001 adjusttokenprivileges, openprocesstoken, setthreadtoken
    high Process injection
    Writes and runs code inside another process
    		 T1055.004, T1055.012 getthreadcontext, queueuserapc, setthreadcontext
    high Anti-debugging
    Detects or obstructs a debugger
    		 T1622 isdebuggerpresent, outputdebugstringa
    med Evasion / stalling
    Sleeps, times, or otherwise stalls analysis
    		 T1497, T1497.003 getsystemtimeasfiletime, gettickcount, gettickcount64, queryperformancecounter, sleep, sleepex
    med Code execution
    Creates processes / runs commands or shellcode
    		 T1106, T1203 createprocessw, createthread, shellexecutew
    med Dynamic API resolution
    Resolves APIs at runtime (obfuscation)
    		 T1129 getprocaddress, loadlibrarya, loadlibraryexa
    med Ransomware behaviour
    Enumerates + encrypts files, deletes backups
    		 T1083 findnextfilew
    low Discovery
    Enumerates the host, users, processes or network
    		 T1082 getsysteminfo

    Security mitigations

    strong posture
    ON ASLR (DynamicBase)
    ON High-entropy ASLR (64-bit)
    ON DEP / NX (NxCompat)
    ON Control Flow Guard
    OFF SafeSEH
    ON Stack cookies (GS)
    OFF Force Integrity
    OFF AppContainer isolation
    OFF Authenticode signed

    Rich header (toolchain)

    richhash 1deb743cfd072257
    ToolBuildUses
    prodid_1473072922
    Cvtres 14.103522336
    Utc1900 (VS2017)3520710
    Cvtres 14.103520718
    Export 14.1035207102
    Cvtres 14.10331458
    Utc1900 (VS2017)3314513
    Import (linker)0519
    Utc1900 (VS2017)3522320
    prodid_26535223598
    Alias352231
    Implib352231
    AliasObj 14.10352231

    Sections

    9 sections · the file's memory layout
    SectionVirtual addrRaw sizeVirtual sizeAccessEntropy
    .textEP
    Executable code
    		 0x1000
    6.3 MB
    6.3 MB
    EXECUTEREAD
    6.4506
    .CLR_UEF
    Non-standard section
    		 0x648000
    512.0 B
    215.0 B
    EXECUTEREAD
    3.0999
    .rdata
    Read-only data
    		 0x649000
    1.5 MB
    1.5 MB
    READ
    5.6853
    .data
    Initialised data
    		 0x7d2000
    24.0 KB
    104.5 KB
    expands
    READWRITE
    2.9224
    .pdata
    Exception unwind data
    		 0x7ed000
    226.0 KB
    225.6 KB
    READ
    6.4807
    .didat
    Delay-load imports
    		 0x826000
    512.0 B
    56.0 B
    READWRITE
    0.4098
    Section
    Non-standard section
    		 0x827000
    512.0 B
    8.0 B
    READWRITE
    0.0
    .rsrc
    Resources
    		 0x828000
    1.7 MB
    1.7 MB
    READ
    5.8896
    .reloc
    Base relocations
    		 0x9d0000
    31.0 KB
    31.0 KB
    READ
    5.451
    code data imports/exports resources metadata packer non-standard Entropy above 7.0 means compressed or encrypted content.

    Imports

    455 funcs / 17 DLLs · 18 suspicious
    ▸KERNEL32.dll199 funcs 14 suspicious
    NameFile RVAIs undocumentedMITRE (tactic - technique)
    RaiseException 0x006490a8 - -
    FreeLibrary 0x006490b0 - -
    SetErrorMode 0x006490b8 - -
    RaiseFailFastException 0x006490c0 - -
    GetExitCodeProcess 0x006490c8 - -
    TerminateProcess 0x006490d0 - -
    UnhandledExceptionFilter 0x006490d8 - -
    SetUnhandledExceptionFilter 0x006490e0 - -
    LocateXStateFeature 0x006490e8 - -
    AddVectoredExceptionHandler 0x006490f0 - -
    MultiByteToWideChar 0x006490f8 - -
    GetTickCount 0x00649100 - T1497
    FlushInstructionCache 0x00649108 - -
    QueryPerformanceFrequency 0x00649110 - -
    QueryPerformanceCounter 0x00649118 - T1497
    RtlLookupFunctionEntry 0x00649120 yes -
    RtlDeleteFunctionTable 0x00649128 yes -
    InterlockedPushEntrySList 0x00649130 - -
    InterlockedFlushSList 0x00649138 - -
    InitializeSListHead 0x00649140 - -
    GetTickCount64 0x00649148 - -
    DuplicateHandle 0x00649150 - -
    VerSetConditionMask 0x00649158 - -
    VerifyVersionInfoW 0x00649160 - -
    QueueUserAPC 0x00649168 - T1055
    WaitForSingleObjectEx 0x00649170 - -
    SetThreadPriority 0x00649178 - -
    GetThreadPriority 0x00649180 - -
    GetCurrentThreadId 0x00649188 - -
    TlsAlloc 0x00649190 - -
    GetCurrentThread 0x00649198 - -
    CreateThread 0x006491a0 - -
    WaitForMultipleObjectsEx 0x006491a8 - -
    SignalObjectAndWait 0x006491b0 - -
    RtlCaptureContext 0x006491b8 yes -
    SetThreadStackGuarantee 0x006491c0 - -
    VirtualQuery 0x006491c8 - -
    WriteFile 0x006491d0 - -
    GetStdHandle 0x006491d8 - -
    GetConsoleOutputCP 0x006491e0 - -
    MapViewOfFileEx 0x006491e8 - -
    UnmapViewOfFile 0x006491f0 - -
    GetCurrentProcessId 0x006491f8 - -
    InterlockedPopEntrySList 0x00649200 - -
    GetModuleHandleW 0x00649208 - -
    ExitProcess 0x00649210 - -
    Sleep 0x00649218 - -
    CreateMemoryResourceNotification 0x00649220 - -
    VirtualAlloc 0x00649228 - T1055
    VirtualFree 0x00649230 - -
    VirtualProtect 0x00649238 - T1055
    SleepEx 0x00649240 - -
    SwitchToThread 0x00649248 - -
    SuspendThread 0x00649250 - -
    ResumeThread 0x00649258 - -
    InitializeContext 0x00649260 - -
    SetXStateFeaturesMask 0x00649268 - -
    RtlRestoreContext 0x00649270 yes -
    CloseThreadpoolTimer 0x00649278 - -
    CreateThreadpoolTimer 0x00649280 - -
    SetThreadpoolTimer 0x00649288 - -
    ReadFile 0x00649290 - -
    GetFileSize 0x00649298 - -
    GetEnvironmentVariableW 0x006492a0 - -
    SetEnvironmentVariableW 0x006492a8 - -
    CreateEventW 0x006492b0 - -
    SetEvent 0x006492b8 - -
    ResetEvent 0x006492c0 - -
    GetThreadContext 0x006492c8 - -
    SetThreadContext 0x006492d0 - T1055
    GetEnabledXStateFeatures 0x006492d8 - -
    CopyContext 0x006492e0 - -
    WerRegisterRuntimeExceptionModule 0x006492e8 - -
    RtlInstallFunctionTableCallback 0x006492f0 yes -
    GetSystemDefaultLCID 0x006492f8 - -
    GetUserDefaultLCID 0x00649300 - -
    RtlUnwind 0x00649308 yes -
    GetCurrentProcessorNumberEx 0x00649310 - -
    FreeEnvironmentStringsW 0x00649318 - -
    GetActiveProcessorGroupCount 0x00649320 - -
    GetSystemTimeAsFileTime 0x00649328 - -
    GetSystemTime 0x00649330 - -
    GetEnvironmentStringsW 0x00649338 - -
    CloseHandle 0x00649340 - -
    RemoveDirectoryW 0x00649348 - -
    CreateActCtxW 0x00649350 - -
    ActivateActCtx 0x00649358 - -
    FindResourceW 0x00649360 - -
    GetWindowsDirectoryW 0x00649368 - -
    LoadLibraryExW 0x00649370 - -
    LoadLibraryExA 0x00649378 - -
    GetACP 0x00649380 - -
    LCMapStringEx 0x00649388 - -
    FormatMessageW 0x00649390 - -
    LocalFree 0x00649398 - -
    GetLogicalProcessorInformationEx 0x006493a0 - -
    SetThreadGroupAffinity 0x006493a8 - -
    GetThreadGroupAffinity 0x006493b0 - -
    GetProcessGroupAffinity 0x006493b8 - -
    GetProcessAffinityMask 0x006493c0 - -
    QueryInformationJobObject 0x006493c8 - -
    HeapAlloc 0x006493d0 - -
    HeapFree 0x006493d8 - -
    CreateFileMappingW 0x006493e0 - -
    HeapCreate 0x006493e8 - -
    GetProcessHeap 0x006493f0 - -
    HeapDestroy 0x006493f8 - -
    SetConsoleCtrlHandler 0x00649400 - -
    FlsAlloc 0x00649408 - -
    FlsSetValue 0x00649410 - -
    FlsGetValue 0x00649418 - -
    GetLocaleInfoEx 0x00649420 - -
    GetUserDefaultLocaleName 0x00649428 - -
    GetModuleFileNameW 0x00649430 - -
    CreateFileW 0x00649438 - -
    GetFileAttributesExW 0x00649440 - -
    GetFullPathNameW 0x00649448 - -
    CreateProcessW 0x00649450 - T1106
    GetCPInfo 0x00649458 - -
    RtlAddFunctionTable 0x00649460 yes -
    CreateNamedPipeA 0x00649468 - -
    WaitForMultipleObjects 0x00649470 - -
    DisconnectNamedPipe 0x00649478 - -
    CreateFileA 0x00649480 - -
    CancelIoEx 0x00649488 - -
    GetOverlappedResult 0x00649490 - -
    ConnectNamedPipe 0x00649498 - -
    FlushFileBuffers 0x006494a0 - -
    OpenEventW 0x006494a8 - -
    ReleaseMutex 0x006494b0 - -
    ExitThread 0x006494b8 - -
    CreateMutexW 0x006494c0 - T1027
    HeapReAlloc 0x006494c8 - -
    CreateSemaphoreExW 0x006494d0 - -
    ReleaseSemaphore 0x006494d8 - -
    OutputDebugStringA 0x006494e0 - T1622
    SetFilePointer 0x006494e8 - -
    MapViewOfFile 0x006494f0 - -
    QueryThreadCycleTime 0x006494f8 - -
    GetStringTypeW 0x00649500 - -
    TlsSetValue 0x00649508 - -
    TlsGetValue 0x00649510 - -
    GetSystemInfo 0x00649518 - -
    GetCurrentProcess 0x00649520 - -
    OutputDebugStringW 0x00649528 - T1622
    IsDebuggerPresent 0x00649530 - T1622
    LeaveCriticalSection 0x00649538 - -
    EnterCriticalSection 0x00649540 - -
    DeleteCriticalSection 0x00649548 - -
    InitializeCriticalSection 0x00649550 - -
    GetCommandLineW 0x00649558 - -
    GetProcAddress 0x00649560 - T1129
    GetModuleHandleExW 0x00649568 - -
    SetThreadErrorMode 0x00649570 - -
    FlushProcessWriteBuffers 0x00649578 - -
    SetLastError 0x00649580 - -
    DebugBreak 0x00649588 - -
    WaitForSingleObject 0x00649590 - -
    InitializeCriticalSectionEx 0x00649598 - -
    DecodePointer 0x006495a0 - -
    GetFileSizeEx 0x006495a8 - -
    FindFirstFileExW 0x006495b0 - -
    FindNextFileW 0x006495b8 - T1083
    GetTempPathW 0x006495c0 - -
    FindClose 0x006495c8 - -
    GetConsoleMode 0x006495d0 - -
    LoadLibraryA 0x006495d8 - T1129
    GetCurrentDirectoryW 0x006495e0 - -
    WriteConsoleW 0x006495e8 - -
    IsWow64Process 0x006495f0 - -
    CreateFileMappingA 0x006495f8 - -
    GetNumaHighestNodeNumber 0x00649600 - -
    GetLastError 0x00649608 - -
    CreateDirectoryW 0x00649610 - -
    WideCharToMultiByte 0x00649618 - -
    GetExitCodeThread 0x00649620 - -
    TryAcquireSRWLockExclusive 0x00649628 - -
    TlsFree 0x00649630 - -
    InitializeCriticalSectionAndSpinCount 0x00649638 - -
    EncodePointer 0x00649640 - -
    RtlPcToFileHeader 0x00649648 yes -
    RtlUnwindEx 0x00649650 yes -
    IsProcessorFeaturePresent 0x00649658 - -
    RtlVirtualUnwind 0x00649660 yes -
    SleepConditionVariableSRW 0x00649668 - -
    WakeAllConditionVariable 0x00649670 - -
    AcquireSRWLockExclusive 0x00649678 - -
    ReleaseSRWLockExclusive 0x00649680 - -
    GlobalMemoryStatusEx 0x00649688 - -
    GetLogicalProcessorInformation 0x00649690 - -
    K32GetProcessMemoryInfo 0x00649698 - -
    IsProcessInJob 0x006496a0 - -
    GetLargePageMinimum 0x006496a8 - -
    SetThreadAffinityMask 0x006496b0 - -
    SetThreadIdealProcessorEx 0x006496b8 - -
    GetThreadIdealProcessorEx 0x006496c0 - -
    VirtualAllocExNuma 0x006496c8 - -
    GetNumaProcessorNodeEx 0x006496d0 - -
    VirtualUnlock 0x006496d8 - -
    ▸ADVAPI32.dll20 funcs 3 suspicious
    NameFile RVAIs undocumentedMITRE (tactic - technique)
    LookupPrivilegeValueW 0x00649000 - T1134
    RegGetValueW 0x00649008 - -
    SetKernelObjectSecurity 0x00649010 - -
    RegQueryValueExW 0x00649018 - -
    RegOpenKeyExW 0x00649020 - -
    GetSidSubAuthorityCount 0x00649028 - -
    GetSidSubAuthority 0x00649030 - -
    GetTokenInformation 0x00649038 - -
    OpenProcessToken 0x00649040 - T1134
    RegCloseKey 0x00649048 - -
    DeregisterEventSource 0x00649050 - -
    RegisterEventSourceW 0x00649058 - -
    ReportEventW 0x00649060 - -
    EventRegister 0x00649068 - -
    SetThreadToken 0x00649070 - -
    RevertToSelf 0x00649078 - -
    OpenThreadToken 0x00649080 - -
    EventWriteTransfer 0x00649088 - -
    EventWrite 0x00649090 - -
    AdjustTokenPrivileges 0x00649098 - T1134
    ▸ole32.dll18 funcs
    NameFile RVAIs undocumentedMITRE (tactic - technique)
    CoCreateFreeThreadedMarshaler 0x00649e28 - -
    CreateStreamOnHGlobal 0x00649e30 - -
    CoRevokeInitializeSpy 0x00649e38 - -
    CoGetContextToken 0x00649e40 - -
    CoGetObjectContext 0x00649e48 - -
    CoUnmarshalInterface 0x00649e50 - -
    CoMarshalInterface 0x00649e58 - -
    CoGetMarshalSizeMax 0x00649e60 - -
    CLSIDFromProgID 0x00649e68 - -
    CoTaskMemFree 0x00649e70 - -
    CoReleaseMarshalData 0x00649e78 - -
    CoTaskMemAlloc 0x00649e80 - -
    CoCreateGuid 0x00649e88 - -
    CoInitializeEx 0x00649e90 - -
    CoRegisterInitializeSpy 0x00649e98 - -
    CoWaitForMultipleHandles 0x00649ea0 - -
    CoUninitialize 0x00649ea8 - -
    CoGetClassObject 0x00649eb0 - -
    ▸OLEAUT32.dll27 funcs
    NameFile RVAIs undocumentedMITRE (tactic - technique)
    SysAllocString 0x006496e8 - -
    SysAllocStringLen 0x006496f0 - -
    SafeArrayGetDim 0x006496f8 - -
    SafeArrayGetLBound 0x00649700 - -
    SafeArrayDestroy 0x00649708 - -
    QueryPathOfRegTypeLib 0x00649710 - -
    SysStringLen 0x00649718 - -
    SafeArrayGetVartype 0x00649720 - -
    VariantChangeType 0x00649728 - -
    CreateErrorInfo 0x00649730 - -
    LoadRegTypeLib 0x00649738 - -
    SafeArrayPutElement 0x00649740 - -
    SafeArrayCreateVector 0x00649748 - -
    SysAllocStringByteLen 0x00649750 - -
    LoadTypeLibEx 0x00649758 - -
    SysStringByteLen 0x00649760 - -
    SafeArrayGetElemsize 0x00649768 - -
    SafeArrayAllocData 0x00649770 - -
    SafeArraySetRecordInfo 0x00649778 - -
    SysFreeString 0x00649780 - -
    GetRecordInfoFromTypeInfo 0x00649788 - -
    GetErrorInfo 0x00649790 - -
    SetErrorInfo 0x00649798 - -
    VariantClear 0x006497a0 - -
    VariantInit 0x006497a8 - -
    SafeArrayAllocDescriptorEx 0x006497b0 - -
    VarCyFromDec 0x006497b8 - -
    ▸USER32.dll2 funcs
    NameFile RVAIs undocumentedMITRE (tactic - technique)
    LoadStringW 0x006497d8 - -
    MessageBoxW 0x006497e0 - -
    ▸SHELL32.dll1 func 1 suspicious
    NameFile RVAIs undocumentedMITRE (tactic - technique)
    ShellExecuteW 0x006497c8 - T1106
    ▸api-ms-win-crt-string-l1-1-0.dll35 funcs
    NameFile RVAIs undocumentedMITRE (tactic - technique)
    strncpy 0x00649cd8 - -
    _stricmp 0x00649ce0 - -
    _strnicmp 0x00649ce8 - -
    isspace 0x00649cf0 - -
    wcscat_s 0x00649cf8 - -
    towupper 0x00649d00 - -
    iswascii 0x00649d08 - -
    isupper 0x00649d10 - -
    iswspace 0x00649d18 - -
    strnlen 0x00649d20 - -
    _wcsdup 0x00649d28 - -
    isdigit 0x00649d30 - -
    wcsnlen 0x00649d38 - -
    islower 0x00649d40 - -
    isalpha 0x00649d48 - -
    towlower 0x00649d50 - -
    strtok_s 0x00649d58 - -
    wcsncat_s 0x00649d60 - -
    strncat_s 0x00649d68 - -
    strcmp 0x00649d70 - -
    __strncnt 0x00649d78 - -
    _wcsnicmp 0x00649d80 - -
    strlen 0x00649d88 - -
    wcscpy_s 0x00649d90 - -
    wcsncpy_s 0x00649d98 - -
    _wcsicmp 0x00649da0 - -
    strcpy_s 0x00649da8 - -
    strcat_s 0x00649db0 - -
    toupper 0x00649db8 - -
    tolower 0x00649dc0 - -
    wcsncmp 0x00649dc8 - -
    strncmp 0x00649dd0 - -
    iswupper 0x00649dd8 - -
    _strdup 0x00649de0 - -
    strncpy_s 0x00649de8 - -
    ▸api-ms-win-crt-stdio-l1-1-0.dll34 funcs
    NameFile RVAIs undocumentedMITRE (tactic - technique)
    __stdio_common_vfwprintf 0x00649bc0 - -
    __stdio_common_vsscanf 0x00649bc8 - -
    __acrt_iob_func 0x00649bd0 - -
    _set_fmode 0x00649bd8 - -
    __stdio_common_vswprintf 0x00649be0 - -
    fflush 0x00649be8 - -
    __stdio_common_vfprintf 0x00649bf0 - -
    ftell 0x00649bf8 - -
    fseek 0x00649c00 - -
    _setmode 0x00649c08 - -
    _dup 0x00649c10 - -
    _fileno 0x00649c18 - -
    _flushall 0x00649c20 - -
    __stdio_common_vsnprintf_s 0x00649c28 - -
    fputs 0x00649c30 - -
    __stdio_common_vsnwprintf_s 0x00649c38 - -
    _get_stream_buffer_pointers 0x00649c40 - -
    _fseeki64 0x00649c48 - -
    fread 0x00649c50 - -
    fsetpos 0x00649c58 - -
    ungetc 0x00649c60 - -
    setvbuf 0x00649c68 - -
    fgetpos 0x00649c70 - -
    fgets 0x00649c78 - -
    fgetc 0x00649c80 - -
    fputc 0x00649c88 - -
    _wfsopen 0x00649c90 - -
    __p__commode 0x00649c98 - -
    fputwc 0x00649ca0 - -
    _wfopen 0x00649ca8 - -
    fopen 0x00649cb0 - -
    fwrite 0x00649cb8 - -
    __stdio_common_vsprintf_s 0x00649cc0 - -
    fclose 0x00649cc8 - -
    ▸api-ms-win-crt-runtime-l1-1-0.dll25 funcs
    NameFile RVAIs undocumentedMITRE (tactic - technique)
    _invoke_watson 0x00649af0 - -
    _beginthreadex 0x00649af8 - -
    terminate 0x00649b00 - -
    _wcserror_s 0x00649b08 - -
    abort 0x00649b10 - -
    _errno 0x00649b18 - -
    exit 0x00649b20 - -
    _register_thread_local_exe_atexit_callback 0x00649b28 - -
    _c_exit 0x00649b30 - -
    __p___wargv 0x00649b38 - -
    __p___argc 0x00649b40 - -
    _controlfp_s 0x00649b48 - -
    _exit 0x00649b50 - -
    _initterm_e 0x00649b58 - -
    _initterm 0x00649b60 - -
    _get_initial_wide_environment 0x00649b68 - -
    _initialize_wide_environment 0x00649b70 - -
    _configure_wide_argv 0x00649b78 - -
    _set_app_type 0x00649b80 - -
    _seh_filter_exe 0x00649b88 - -
    _cexit 0x00649b90 - -
    _crt_atexit 0x00649b98 - -
    _register_onexit_function 0x00649ba0 - -
    _initialize_onexit_table 0x00649ba8 - -
    _invalid_parameter_noinfo 0x00649bb0 - -
    ▸api-ms-win-crt-convert-l1-1-0.dll8 funcs
    NameFile RVAIs undocumentedMITRE (tactic - technique)
    _atoi64 0x006497f0 - -
    strtoul 0x006497f8 - -
    atol 0x00649800 - -
    wcstoul 0x00649808 - -
    _wtoi 0x00649810 - -
    strtoull 0x00649818 - -
    _wcstoui64 0x00649820 - -
    _ltow_s 0x00649828 - -
    ▸api-ms-win-crt-heap-l1-1-0.dll8 funcs
    NameFile RVAIs undocumentedMITRE (tactic - technique)
    _set_new_mode 0x00649870 - -
    _aligned_malloc 0x00649878 - -
    realloc 0x00649880 - -
    free 0x00649888 - -
    calloc 0x00649890 - -
    _aligned_free 0x00649898 - -
    malloc 0x006498a0 - -
    _callnewh 0x006498a8 - -
    ▸api-ms-win-crt-utility-l1-1-0.dll1 func
    NameFile RVAIs undocumentedMITRE (tactic - technique)
    qsort 0x00649e18 - -
    ▸api-ms-win-crt-math-l1-1-0.dll59 funcs
    NameFile RVAIs undocumentedMITRE (tactic - technique)
    acoshf 0x00649910 - -
    modf 0x00649918 - -
    atanh 0x00649920 - -
    acosh 0x00649928 - -
    cbrt 0x00649930 - -
    asinh 0x00649938 - -
    atanhf 0x00649940 - -
    tanhf 0x00649948 - -
    _fdopen 0x00649950 - -
    acos 0x00649958 - -
    acosf 0x00649960 - -
    asin 0x00649968 - -
    copysign 0x00649970 - -
    copysignf 0x00649978 - -
    ilogbf 0x00649980 - -
    trunc 0x00649988 - -
    truncf 0x00649990 - -
    asinf 0x00649998 - -
    atan 0x006499a0 - -
    modff 0x006499a8 - -
    atan2f 0x006499b0 - -
    atanf 0x006499b8 - -
    ceil 0x006499c0 - -
    asinhf 0x006499c8 - -
    ceilf 0x006499d0 - -
    cos 0x006499d8 - -
    cosf 0x006499e0 - -
    cosh 0x006499e8 - -
    coshf 0x006499f0 - -
    exp 0x006499f8 - -
    expf 0x00649a00 - -
    floor 0x00649a08 - -
    floorf 0x00649a10 - -
    fma 0x00649a18 - -
    fmaf 0x00649a20 - -
    fmod 0x00649a28 - -
    fmodf 0x00649a30 - -
    log 0x00649a38 - -
    log10 0x00649a40 - -
    log10f 0x00649a48 - -
    log2 0x00649a50 - -
    __setusermatherr 0x00649a58 - -
    log2f 0x00649a60 - -
    logf 0x00649a68 - -
    pow 0x00649a70 - -
    powf 0x00649a78 - -
    roundf 0x00649a80 - -
    sin 0x00649a88 - -
    sinf 0x00649a90 - -
    sinhf 0x00649a98 - -
    cbrtf 0x00649aa0 - -
    sqrt 0x00649aa8 - -
    sqrtf 0x00649ab0 - -
    atan2 0x00649ab8 - -
    tan 0x00649ac0 - -
    round 0x00649ac8 - -
    tanf 0x00649ad0 - -
    tanh 0x00649ad8 - -
    sinh 0x00649ae0 - -
    ▸api-ms-win-crt-time-l1-1-0.dll3 funcs
    NameFile RVAIs undocumentedMITRE (tactic - technique)
    _time64 0x00649df8 - -
    _gmtime64_s 0x00649e00 - -
    wcsftime 0x00649e08 - -
    ▸api-ms-win-crt-environment-l1-1-0.dll1 func
    NameFile RVAIs undocumentedMITRE (tactic - technique)
    getenv 0x00649838 - -
    ▸api-ms-win-crt-filesystem-l1-1-0.dll4 funcs
    NameFile RVAIs undocumentedMITRE (tactic - technique)
    _wrename 0x00649848 - -
    _unlock_file 0x00649850 - -
    _wremove 0x00649858 - -
    _lock_file 0x00649860 - -
    ▸api-ms-win-crt-locale-l1-1-0.dll10 funcs
    NameFile RVAIs undocumentedMITRE (tactic - technique)
    _lock_locales 0x006498b8 - -
    _unlock_locales 0x006498c0 - -
    setlocale 0x006498c8 - -
    __pctype_func 0x006498d0 - -
    ___lc_locale_name_func 0x006498d8 - -
    ___lc_codepage_func 0x006498e0 - -
    ___mb_cur_max_func 0x006498e8 - -
    _create_locale 0x006498f0 - -
    _free_locale 0x006498f8 - -
    _configthreadlocale 0x00649900 - -

    Binary metadata

    what the headers declare about this build
    Resource langsNEU
    Debug infoyes
    TLS callbacksyes

    Code signing

    Unsigned

    This binary carries no Authenticode signature. Unsigned executables are a weak suspicious signal - most legitimate vendor software is signed.

    Similar samples

    3 related samples

    Ranked by fuzzy hash (TLSH distance - lower is closer) and ssdeep similarity, plus an identical import table. A near-identical neighbour is usually the same build; a variant is the same family rebuilt or repacked.

    RelationSampleVerdictWhy it matched
    near-identical SACGUI.exe Suspicious TLSH distance 18
    variant Rewind.Launcher.exe Suspicious TLSH distance 55
    variant meccha-camouflage-v1.7.2.exe Malicious TLSH distance 70

    Threat classification

    Signature family candidates
    FamilyAgreeing rulesMatched rulesDisposition
    COD3NYM DOTNET Singlefilehost Bundled App1COD3NYM_DOTNET_Singlefilehost_Bundled_App Not a classification: one rule cannot establish a family, so this named nothing and scored nothing.

    Capability detection

    not completed

    The capability analysis of this file's code did not finish, so what the file is able to do was not established from its instructions. This narrows what the run covered - read it alongside Coverage rather than as a finding about the file. Cause: the check ran past its time limit and was stopped.

    Signature matches

    4 findings · 6 file properties · 2 scored
    Rule What it matched Corpus Weight
    Suspicious_Anti_Debug_API
    Anti-debugging API names referenced
    2 of 4 strings matched
    $a IsDebuggerPresent at 0x7cdc5e · 2 hits
    $d OutputDebugString at 0x7cdc72 · 2 hits
    Built-in
    ruleset this platform ships, and the only one the score reads
    		 SCORED 5
    Scored 5, sharing a 15 point cap with every other anti-vm, anti-debug, dropper or packer match.
    Embedded_PE_In_Overlay
    A second MZ/PE header appears inside the file body
    1 of 1 string matched
    $mz MZ at 0x0 · 964 hits
    Built-in
    ruleset this platform ships, and the only one the score reads
    		 SCORED 5
    Scored 5, sharing a 15 point cap with every other anti-vm, anti-debug, dropper or packer match.
    COD3NYM_DOTNET_Singlefilehost_Bundled_App
    FILE
    rule dated 2024-01-02
    Detects single file host .NET bundled apps.
    1 of 2 strings matched
    $ singlefilehost.exe at 0x7cca94
    $ singlefilehost.pdb at 0x74fa5d
    Tier 2 - community rule feed
    may confirm a family name, never establish one on its own
    		 SCORED 0
    Scored 0: the rule declares no category. No branch of the score model reads it.
    Names COD3NYM DOTNET Singlefilehost Bundled App, but one rule cannot establish a family: two independent rules must agree, so this named nothing.
    maldoc_indirect_function_call_3
    maldoc
    No description
    1 of 1 string matched
    $a \xff\xb7"\xbf\x89\xf2\xffW\xe4 at 0x30de3a7
    Tier 3 - community corpus
    casts no family vote; every measured false family match came from here
    		 SCORED 0
    Scored 0: the rule declares no category. No branch of the score model reads it.
    File properties - not findings
    IsPE64IsWindowsGUIIsPackedHasOverlayHasDebugDataHasRichSignature

    These say what the file IS or holds - bitness, subsystem, an overlay, an embedded macro stream, which compiler built it. Ordinary files match several, and none of them carry weight in the score.

    Extracted strings

    showing 200 of 1406
    • !This program cannot be run in DOS mode.
    • JRich
    • .text
    • `.CLR_UEF
    • `.rdata
    • @.data
    • .pdata
    • @.didat
    • Section
    • .rsrc
    • @.reloc
    • |$ ATAVAW3
    • { ATAVAWH
    • VWATAVAWH
    • |$ ATAVAWH
    • l$ VWATAVAWH
    • EH;Ehs
    • UWATAVAWH
    • USVWATAUAVAWH
    • ATAVAWH
    • @USVH
    • @USVWATAVAWH
    • @UVATH
    • UVWATAWH
    • t$ AWD
    • \$ VATAWH
    • |$ ATAUAVH
    • @UWATAVAWH
    • ;~Hriw
    • FLL9}`t
    • @USWH
    • @USVWATAUAVAWH
    • t$ WATAUAVAW
    • ATAUAVAWH
    • VATAVH
    • VWATAUAVH
    • @USWATAUAVAWH
    • t$ UWATAVAWH
    • CPA9D$
    • CHI9D$
    • CTA9D$
    • CHA8D$
    • CLA9D$
    • TOOR
    • TOORt
    • UWATAUAWH
    • @SUVATAWH
    • l$ AVL
    • USVWATAVAWH
    • USWH
    • RLCH
    • [ VWATAVAWH
    • taeH
    • ouKH
    • HESt
    • = HESuCH
    • EDA9E@u
    • UATAVH
    • @UVWATAWH
    • USVWH
    • utfA
    • @UATAVH
    • USVWATAWH
    • @SATAUAWL
    • s.ff
    • %x.^
    • USVWATAUAWI
    • \$ UVATAVAWH
    • ouLI
    • @VATAVH
    • VWATAVH
    • VWATH
    • t.fA
    • @UATAWH
    • @UATAVAWH
    • %.yZ
    • VWATAUAWH
    • ouvH
    • tefA;
    • urfA;
    • t$ AVH
    • AH;Ahu
    • @UWATAUAVH
    • @SUATAVH
    • @USVWH
    • r.Hc
    • .dll
    • file
    • KERNEL32.DLL
    • api-ms-win-core-fibers-l1-1-1
    • api-ms-win-core-synch-l1-2-0
    • api-ms-
    • NotSupported_CollectibleBoundNonCollectible
    • NotSupported_CollectibleAssemblyResolve
    • DefaultDomain
    • System.Private.CoreLib.dll
    • cejl
    • RefEmit_InMemoryManifestModule
    • ArgumentNull_AssemblyNameName
    • Default
    • Microsoft.DiaSymReader.Native.amd64.dll
    • Failed to add field to existing instantiated type instance
    • Failed to add method to existing instantiated type instance
    • Failed to add static field to instantiated type instance
    • NATIVE_DLL_SEARCH_DIRECTORIES
    • TRUSTED_PLATFORM_ASSEMBLIES
    • PLATFORM_RESOURCE_ROOTS
    • APP_PATHS
    • DEFAULT_STACK_SIZE
    • USE_ENTRYPOINT_FILTER
    • FaultRep.dll
    • g.NET Stack overflow create dump
    • StatusBreakpoint
    • Unhandled exception.
    • ArgumentNull_Generic
    • NULL
    • System.GC.Name
    • System.GC.Path
    • InvalidOperation_CantInstantiateFunctionPointer
    • InvalidOperation_CantInstantiateAbstractClass
    • InvalidOperation_TypeCannotBeBoxed
    • NotSupported_ByRefLike
    • <null>
    • Failed to load JIT compiler
    • Failed to load alternative JIT compiler
    • (NULL)
    • Arg_MissingFieldException
    • dynamicClass
    • Arg_InvalidUTF8String
    • Argument_GenTypeConstraintsNotEqual
    • Argument_GenMethodConstraintsNotEqual
    • Arg_AmbiguousMatchException_UnsafeAccessor
    • nFailed to setup new thread during reverse P/Invoke
    • @WriteBarrier
    • NotSupported_MaxWaitHandles_STA
    • kernel32
    • .NET Tiered Compilation Worker
    • FNPTR
    • (null)
    • VALUETYPE
    • (dynamicClass)
    • Format_StringZeroLength
    • Arg_InvalidHandle
    • ArgumentNull_String
    • ArgumentNull_FileName
    • Argument_EmptyFileName
    • NotSupported_DebuggerAttached
    • InvalidOperation_AssemblyNotEditable
    • InvalidOperation_EditFailed
    • Arg_OleAutDateInvalid
    • Arg_OleAutDateScale
    • Arg_DlgtTargMeth
    • Argument_NeedNonGenericType
    • delegate
    • Arg_MustBeDelegate
    • method
    • Arg_DlgtNullInst
    • InvalidProgram_NonStaticMethod
    • InvalidProgram_GenericMethod
    • InvalidProgram_NonBlittableTypes
    • NotSupported_UnmanagedCallersOnlyTarget
    • Argument_DuplicateTypeName
    • Argument_BadConstantValue
    • ArgumentNull_Type
    • <In Memory Module>
    • Argument_InvalidFlag
    • ThreadState_AlreadyStarted
    • NullReference_This
    • ThreadState_Dead_Priority
    • ThreadState_SetPriorityFailed
    • ArgumentOutOfRange_NeedNonNegOrNegative1
    • millisecondsTimeout
    • ThreadState_Dead_State
    • ThreadState_NotStarted
    • System.Threading.ThreadPool.MinThreads
    • System.Threading.ThreadPool.MaxThreads
    • System.Threading.ThreadPool.DisableStarvationDetection
    • System.Threading.ThreadPool.DebugBreakOnWorkerStarvation
    • System.Threading.ThreadPool.UnfairSemaphoreSpinLimit
    • System.Threading.ThreadPool.HillClimbing.Disable
    • System.Threading.ThreadPool.HillClimbing.WavePeriod
    • System.Threading.ThreadPool.HillClimbing.TargetSignalToNoiseRatio
    • System.Threading.ThreadPool.HillClimbing.ErrorSmoothingFactor
    • System.Threading.ThreadPool.HillClimbing.WaveMagnitudeMultiplier
    • System.Threading.ThreadPool.HillClimbing.MaxWaveMagnitude
    • System.Threading.ThreadPool.HillClimbing.WaveHistorySize
    • System.Threading.ThreadPool.HillClimbing.Bias
    • System.Threading.ThreadPool.HillClimbing.MaxChangePerSecond
    • System.Threading.ThreadPool.HillClimbing.MaxChangePerSample
    • System.Threading.ThreadPool.HillClimbing.MaxSampleErrorPercent
    • System.Threading.ThreadPool.HillClimbing.SampleIntervalLow
    • System.Threading.ThreadPool.HillClimbing.SampleIntervalHigh
    • System.Threading.ThreadPool.HillClimbing.GainExponent
    • Thread was being aborted.
    • Thread was interrupted from a waiting state.
    • Insufficient memory to continue the execution of the program.
    • NotSupported_InlineArrayEqualsGetHashCode
    • NotSupported_WaitAllSTAThread
    • NotSupported_SignalAndWaitSTAThread
    • NotSupported_ValueClassCM

    Stack and decoded strings were not recovered: this file format is not eligible for string emulation. Only literal strings present in the file are listed above.

    Disassembly

    entry point · x64 · 60 insns (listing capped)
    AddressBytesMnemonicOperands
    0x1405eaf504883ec28subrsp, 0x28
    0x1405eaf54e81b050000call0x1405eb474
    0x1405eaf594883c428addrsp, 0x28
    0x1405eaf5de96afeffffjmp0x1405eadcc
    0x1405eaf62ccint3
    0x1405eaf63ccint3
    0x1405eaf64488d05d5560600learax, [rip + 0x656d5]
    0x1405eaf6b48c7411000000000movqword ptr [rcx + 0x10], 0
    0x1405eaf7348894108movqword ptr [rcx + 8], rax
    0x1405eaf77488d05b2560600learax, [rip + 0x656b2]
    0x1405eaf7e488901movqword ptr [rcx], rax
    0x1405eaf81488bc1movrax, rcx
    0x1405eaf84c3ret
    0x1405eaf85ccint3
    0x1405eaf86ccint3
    0x1405eaf87ccint3
    0x1405eaf884883ec48subrsp, 0x48
    0x1405eaf8c488d4c2420learcx, [rsp + 0x20]
    0x1405eaf91e8ceffffffcall0x1405eaf64
    0x1405eaf96488d1523301e00leardx, [rip + 0x1e3023]
    0x1405eaf9d488d4c2420learcx, [rsp + 0x20]
    0x1405eafa2e8fd190000call0x1405ec9a4
    0x1405eafa7ccint3
    0x1405eafa848895c2410movqword ptr [rsp + 0x10], rbx
    0x1405eafad48896c2418movqword ptr [rsp + 0x18], rbp
    0x1405eafb24889742420movqword ptr [rsp + 0x20], rsi
    0x1405eafb757pushrdi
    0x1405eafb84883ec10subrsp, 0x10
    0x1405eafbc33c0xoreax, eax
    0x1405eafbe33c9xorecx, ecx
    0x1405eafc00fa2cpuid
    0x1405eafc281f16e74656cxorecx, 0x6c65746e
    0x1405eafc881f2696e6549xoredx, 0x49656e69
    0x1405eafce0bd1oredx, ecx
    0x1405eafd08be8movebp, eax
    0x1405eafd2b801000000moveax, 1
    0x1405eafd781f347656e75xorebx, 0x756e6547
    0x1405eafdd0bd3oredx, ebx
    0x1405eafdf8d48ffleaecx, [rax - 1]
    0x1405eafe20fa2cpuid
    0x1405eafe48bf9movedi, ecx
    0x1405eafe6755ejne0x1405eb046
    0x1405eafe825f03fff0fandeax, 0xfff3ff0
    0x1405eafed48c705a0701e0000800000movqword ptr [rip + 0x1e70a0], 0x8000
    0x1405eaff848c7059d701e00ffffffffmovqword ptr [rip + 0x1e709d], 0xffffffffffffffff
    0x1405eb0033dc0060100cmpeax, 0x106c0
    0x1405eb0087428je0x1405eb032
    0x1405eb00a3d60060200cmpeax, 0x20660
    0x1405eb00f7421je0x1405eb032
    0x1405eb0113d70060200cmpeax, 0x20670
    0x1405eb016741aje0x1405eb032
    0x1405eb01805b0f9fcffaddeax, 0xfffcf9b0
    0x1405eb01d83f820cmpeax, 0x20
    0x1405eb0207724ja0x1405eb046
    0x1405eb02248b90100010001000000movabsrcx, 0x100010001
    0x1405eb02c480fa3c1btrcx, rax
    0x1405eb0307314jae0x1405eb046
    0x1405eb032448b05e3d41e00movr8d, dword ptr [rip + 0x1ed4e3]
    0x1405eb0394183c801orr8d, 1
    0x1405eb03d448905d8d41e00movdword ptr [rip + 0x1ed4d8], r8d
    callbranchretstackarithregisterimmediatememory

    Import fingerprint

    no related sample
    Fingerprint192:PI7F71sj0WPBXnSI0bcWCj9Yl7NkOT8QRiaRyOyr:Pm7iJjpA8QRWOyr
    Imports read455 functions from 17 libraries (455 distinct)
    Comparableyes
    Compared against30 stored samples
    Samples built on the same import table

    No stored sample you can see shares this import table.

    Screen recording

    70 frames · screen recording · 166s
    Screen recording frame
    1 / 70
    0:00 · 1/70
    Download this recording Download video (.mp4) Download GIF (.gif) Building the file runs an encode on this platform, so it is kept to signed-in accounts. Signing in brings you back to this report.

    Behavior summary

    ran 165s

    1 process(es) observed; malicious behavior: dropped_executable; 311 dropped executable(s)

    LaunchedC:\Users\user\Desktop\EvoVisLauncher.exe
    Privilegestandard
    dropped_executable
    Telemetry sources: Kernel ETW (408 of 1180 events) - truncated agent poll: 125Process audit: 1keydiff: 8In-process monitor: 15Autostart diff: 42

    Evasion / anti-analysis checks

    3 checks
    MED
    Anti-debug API imports static-api
    MITRE T1622 · getthreadcontext, isdebuggerpresent
    MED
    YARA: Suspicious_Anti_Debug_API Signature
    MITRE T1497
    LOW
    Sleep / time-based stalling dynamic
    MITRE T1497.003 · sleep

    Statically visible checks (RDTSC/CPUID/red-pill instructions, anti-debug APIs) plus runtime evasion signals. Instruction-level interception at runtime requires hypervisor introspection (VMI).

    Anti-analysis API trace

    3 APIs · 1 process hooked

    Calls counted inside the running sample by in-process hooks. Scored means the call crossed the threshold that separates a deliberate check from what ordinary software does; a call that scored nothing is still listed, with the reason.

    APISignalCallsSleepScored
    GetTickCount timing 10145 - no corroborates, never convicts on its own - ordinary software calls this
    GetTickCount64 timing 11 - no corroborates, never convicts on its own - ordinary software calls this
    Sleep sleep 8 100 ms total · 2147483647 ms max yes
    Call order 11 events sampled
    GetTickCountGetTickCountGetTickCountGetTickCountSleepGetTickCountGetTickCount64GetTickCount64GetTickCountGetTickCount64Sleep

    How to read the numbers: a repeated call is sampled at 1, 10, 100 and so on while the run is live and made exact when the process exits, so a count is a floor and not a total. The count kept for a name is the highest a single process reported, not a sum across the process tree. The hooks are placed a few seconds after a process starts, so a check made in the first moments of a launch is missed - and a sample that exits in those first seconds is never watched at all.

    No module load worth listing. In-process hooks were placed in 1 process and recorded no explicit module load, so this is an observation rather than a gap. Modules brought in by the sample's own import table are never seen here.

    No WMI attributed to the sample. The WMI-Activity trace was running and recorded 668 operations on the machine during the run; none of them came from the sample's process tree.

    Command lines, unwrapped

    1 read

    1 captured text was read and unwrapped locally. No address was recovered from any of them, and none of them was hiding its own contents behind an encoding or a format string. This is a result, not a gap.

    Network activity

    The network section is a paid-plan layer: the DNS the sample resolved, the connections it opened, the TLS it negotiated, and the rule engine's reading of the capture.

    This run was captured, and what it captured is on a paid plan rather than absent. An internet-connected detonation is the same plan, so a paid run also shows what the sample reached rather than only what it tried.

    See plans Create an account

    Process tree

    What ran during the detonation, and what each process did. Select a node to see the activity attributed to it.

    1process
    300file operations
    14registry operations
    100dropped files

    EvoVisLauncher.exe

    1 process
    1 process

    Attributed activity

    Not attributed to any process

    1 kind

    These operations were captured but carry no pid this tree could match, so they are not shown against any node above.

    Registry operations50
    1Mechanisms found
    90Methods checked
    1ATT&CK techniques
    LOWHighest severity

    Persistence mechanisms

    1 found
    MethodFamilyATT&CKEvidenceSeverity
    .NET Startup Hook DLL DLL Load Order T1574 Static hint LOW

    Runtime evidence means the mechanism was established during detonation. A static hint means the sample only references the technique.

    Detection coverage

    1 / 90

    Every auto-start method checked on this sample, grouped by family. A method with no result is reported clean, and one the sample only names in its own strings reads "named" rather than "detected".

    Logon & Startup 22 clean
    • Active Setup Installed Component T1547.014 clean
    • Explorer Delay-Load Object T1547.001 clean
    • Explorer Run Key T1547.001 clean
    • Explorer SharedTaskScheduler T1547.001 clean
    • Group Policy Extension DLL T1547.004 clean
    • Group Policy Run Key T1547.001 clean
    • Logon Script T1037.001 clean
    • RDP WDS Startup Program T1547.001 clean
    • Registry Run Key T1547.001 clean
    • Registry RunEx Key T1547.001 clean
    • Registry RunOnce Key T1547.001 clean
    • Registry RunOnceEx Key T1547.001 clean
    • Registry RunServices Key T1547.001 clean
    • Startup Folder Item T1547.001 clean
    • Startup Folder Redirection T1547.001 clean
    • Terminal Services Initial Program T1547.001 clean
    • Winlogon GINA DLL T1547.004 clean
    • Winlogon MPNotify Value T1547.004 clean
    • Winlogon Notify Package T1547.004 clean
    • Winlogon Shell Value T1547.004 clean
    • Winlogon Taskman Value T1547.004 clean
    • Winlogon Userinit Value T1547.004 clean
    Services & Tasks 9 clean
    • BITS Job T1197 clean
    • Print Monitor DLL T1547.010 clean
    • Print Processor DLL T1547.012 clean
    • Scheduled Task T1053.005 clean
    • Scheduled Task Registry Implant T1053.005 clean
    • Service Control Manager Security Descriptor T1574.011 clean
    • Service DLL Hijack T1543.003 clean
    • Time Provider DLL T1547.003 clean
    • Windows Service Creation T1543.003 clean
    Execution Hijack 17 clean
    • .NET Managed Debugger T1546.012 clean
    • Accessibility Tool Hijack T1546.008 clean
    • AeDebug Postmortem Debugger T1546.012 clean
    • App Paths Hijack T1546.012 clean
    • Application Shim Database T1546.011 clean
    • Boot Verification Program T1547.002 clean
    • Command Processor AutoRun T1546.011 clean
    • Explorer Load Value T1547.001 clean
    • Explorer MyComputer Tool Hijack T1546.001 clean
    • Registry Image File Execution Options T1546.012 clean
    • Screensaver Hijack T1546.002 clean
    • Setup ErrorHandler Script T1546 clean
    • Shell Open Command Hijack T1546.001 clean
    • SilentProcessExit Monitor T1546.012 clean
    • Telemetry Controller Command T1546.015 clean
    • WER ReflectDebugger T1546.012 clean
    • Windows Error Reporting Debugger T1546.012 clean
    DLL Load Order 1 / 12
    • .NET CLR Profiler DLL T1574.012 clean
    • .NET Startup Hook DLL T1574 named
    • AppCert DLLs T1546.009 clean
    • AppInit DLLs T1546.010 clean
    • AutodialDLL Winsock Injection T1546.006 clean
    • DLL Search-Order Hijack T1574.001 T1574.002 clean
    • DNS Server Plugin DLL T1574.001 clean
    • HTML Help Helper DLL T1546 clean
    • KnownDLLs Manipulation T1574.001 clean
    • Natural Language Platform DLL Override T1546 clean
    • Netsh Helper DLL T1546.007 clean
    • Winsock Layered Service Provider T1546.006 clean
    COM & Browser 6 clean
    • Browser Extension T1176 clean
    • Browser Helper Object T1176 clean
    • COM Server Hijack T1546.015 clean
    • HTML Help COM Object Hijack T1546.015 clean
    • Shell Context Menu Handler T1546.001 clean
    • Shell Extension Handler T1546.001 clean
    Security Providers & Accounts 11 clean
    • Account RID Hijack T1098 clean
    • AMSI Provider T1562.001 clean
    • Credential Provider T1547.014 clean
    • DSRM Admin Logon Backdoor T1556 clean
    • Hidden Local Account T1136.001 clean
    • LSA Authentication Package T1547.002 clean
    • LSA Extension DLL T1547.005 clean
    • LSA Notification Package T1547.005 clean
    • LSA Security Package T1547.005 clean
    • Network Provider DLL T1556.008 clean
    • Security Support Provider T1547.005 clean
    Scripting & Applications 9 clean
    • Netsh Port Proxy T1090.001 clean
    • Office Add-in T1137.006 clean
    • Office Executable Sideload T1574.002 clean
    • Office Startup Template T1137.001 clean
    • Office Test Key T1137.002 clean
    • Power Automate Flow T1546 clean
    • PowerShell Profile T1546.013 clean
    • Windows Terminal Startup Action T1546 clean
    • WMI Event Subscription T1546.003 clean
    Boot & Firmware 4 clean
    • BootExecute Native Image T1547.002 clean
    • PlatformExecute Native Image T1547.002 clean
    • SetupExecute Native Image T1547.002 clean
    • UEFI / Bootkit Artifact T1542.003 T1542.001 clean

    File activity summary

    create 300 write 0 modify 0 delete 0 rename 0

    Dropped files

    100 payloads

    Downloadable copies were kept for 0 distinct payloads. 286 more distinct payloads exceeded the per-scan capture limit and are listed below without bytes.

    PathSHA-256SizeProcessTimeDownload
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\es\PresentationFramework.resources.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\es\PresentationCore.resources.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\WindowsBase.resources.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\UIAutomationTypes.resources.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\UIAutomationProvider.resources.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\runtimes\win-x64\native\WebView2Loader.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\UIAutomationClientSideProviders.resources.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\UIAutomationClient.resources.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\System.Xaml.resources.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetic-thumbs.js - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\System.Windows.Input.Manipulations.resources.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\System.Windows.Controls.Ribbon.resources.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\ReachFramework.resources.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\PresentationUI.resources.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\PresentationFramework.resources.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\PresentationCore.resources.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\WindowsBase.resources.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\UIAutomationTypes.resources.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\UIAutomationProvider.resources.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\UIAutomationClientSideProviders.resources.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\UIAutomationClient.resources.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\System.Xaml.resources.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\System.Windows.Input.Manipulations.resources.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\System.Windows.Controls.Ribbon.resources.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\ReachFramework.resources.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\PresentationUI.resources.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\PresentationFramework.resources.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\PresentationCore.resources.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\wpfgfx_cor3.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\vcruntime140_cor3.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationNative_cor3.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PenImc_cor3.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\D3DCompiler_47_cor3.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\WindowsBase.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\UIAutomationTypes.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\UIAutomationProvider.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\UIAutomationClientSideProviders.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\UIAutomationClient.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Xaml.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Windows.Presentation.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Windows.Input.Manipulations.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Windows.Extensions.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Windows.Controls.Ribbon.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Threading.AccessControl.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Security.Permissions.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Security.Cryptography.Xml.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Security.Cryptography.ProtectedData.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Security.Cryptography.Pkcs.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Resources.Extensions.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Printing.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.IO.Packaging.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Formats.Nrbf.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.DirectoryServices.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Diagnostics.PerformanceCounter.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Diagnostics.EventLog.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Diagnostics.EventLog.Messages.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Configuration.ConfigurationManager.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.CodeDom.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\ReachFramework.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationUI.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework.Royale.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework.Luna.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework.Fluent.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework.Classic.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework.AeroLite.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework.Aero2.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework.Aero.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework-SystemXmlLinq.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework-SystemXml.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework-SystemDrawing.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework-SystemData.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework-SystemCore.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationCore.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\Microsoft.Win32.SystemEvents.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\Microsoft.Win32.Registry.AccessControl.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\DirectWriteForwarder.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\Accessibility.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\netstandard.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\mscorlib.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Xml.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Xml.XmlSerializer.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Xml.XmlDocument.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Xml.XPath.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Xml.XPath.XDocument.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Xml.XDocument.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Xml.Serialization.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Xml.ReaderWriter.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Xml.Linq.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Windows.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Web.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Web.HttpUtility.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.ValueTuple.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Transactions.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Transactions.Local.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Threading.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Threading.Timer.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Threading.ThreadPool.dll - - EvoVisLauncher.exe pid 2444 - -
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Threading.Thread.dll - - EvoVisLauncher.exe pid 2444 - -

    Dropped payload analysis

    not examined

    The capture of dropped payloads did not complete, so no payload was examined on this run. What the sample wrote is listed above by path; what those files are was not established.

    File & registry ops

    300 file · 22 registry · sample scope

    File operation times: 300 not observed

    OperationTargetProcess
    create
    C:\Users\user\AppData\Local\Temp\.net
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\runtimes
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\es\PresentationFramework.resources.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\es\PresentationCore.resources.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\es
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\WindowsBase.resources.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\runtimes\win-x64
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\UIAutomationTypes.resources.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\runtimes\win-x64\native
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\UIAutomationProvider.resources.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\runtimes\win-x64\native\WebView2Loader.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\UIAutomationClientSideProviders.resources.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\UIAutomationClient.resources.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\capes.json
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\System.Xaml.resources.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetic-thumbs.js
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\System.Windows.Input.Manipulations.resources.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics-names.json
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\System.Windows.Controls.Ribbon.resources.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\backpacks
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\backpacks\adidas.geo.json
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\ReachFramework.resources.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\backpacks\adidas.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\backpacks\gucci.geo.json
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\backpacks\gucci.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\backpacks\hermes.geo.json
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\backpacks\hermes.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\backpacks\labubu.geo.json
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\backpacks\labubu.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\backpacks\lui_vuitton.geo.json
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\backpacks\lui_vuitton.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\PresentationUI.resources.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\PresentationFramework.resources.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\PresentationCore.resources.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\WindowsBase.resources.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\UIAutomationTypes.resources.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\UIAutomationProvider.resources.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\UIAutomationClientSideProviders.resources.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\UIAutomationClient.resources.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\System.Xaml.resources.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\System.Windows.Input.Manipulations.resources.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\backpacks\mage_staff.geo.json
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\System.Windows.Controls.Ribbon.resources.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\backpacks\mage_staff.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\ReachFramework.resources.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\backpacks\nike.geo.json
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\backpacks\nike.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\backpacks\snoopy.geo.json
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\PresentationUI.resources.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\PresentationFramework.resources.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\PresentationCore.resources.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\wpfgfx_cor3.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\vcruntime140_cor3.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationNative_cor3.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PenImc_cor3.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\backpacks\snoopy.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\annihil.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\bayoauto.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\bayonet.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\buemerald.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\busnowfall.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\butterfly.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\cobra_vanguard.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\css.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\D3DCompiler_47_cor3.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\WindowsBase.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\UIAutomationTypes.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\UIAutomationProvider.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\UIAutomationClientSideProviders.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\UIAutomationClient.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Xaml.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Windows.Presentation.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Windows.Input.Manipulations.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Windows.Extensions.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Windows.Controls.Ribbon.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Threading.AccessControl.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Security.Permissions.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Security.Cryptography.Xml.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Security.Cryptography.ProtectedData.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Security.Cryptography.Pkcs.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Resources.Extensions.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Printing.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.IO.Packaging.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Formats.Nrbf.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.DirectoryServices.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Diagnostics.PerformanceCounter.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Diagnostics.EventLog.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Diagnostics.EventLog.Messages.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\executor.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\karambit.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\karobsidian.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Configuration.ConfigurationManager.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.CodeDom.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\ReachFramework.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationUI.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\m9.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework.Royale.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\m9amethyst.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework.Luna.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework.Fluent.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework.Classic.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework.AeroLite.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework.Aero2.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework.Aero.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework-SystemXmlLinq.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework-SystemXml.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework-SystemDrawing.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework-SystemData.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\m9auto.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\m9emerald.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\m9holy.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\m9sapphire.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\mercy.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\null_annihil.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\polaris.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\push.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\quenching.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\shadowkiller.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\silencefd.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\skeleton.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\stiletto.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework-SystemCore.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\stilettoholy.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\stilettosapphire.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\stilettott.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\tactical.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\talon.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\thieve_sea.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\melee\icon\treasure_kn.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\skins
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\skins\akita_neru.geo.json
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationCore.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\Microsoft.Win32.SystemEvents.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\Microsoft.Win32.Registry.AccessControl.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\DirectWriteForwarder.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\Accessibility.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\netstandard.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\mscorlib.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Xml.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Xml.XmlSerializer.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Xml.XmlDocument.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Xml.XPath.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Xml.XPath.XDocument.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Xml.XDocument.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Xml.Serialization.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Xml.ReaderWriter.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Xml.Linq.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Windows.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Web.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Web.HttpUtility.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.ValueTuple.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Transactions.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Transactions.Local.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Threading.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Threading.Timer.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Threading.ThreadPool.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Threading.Thread.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Threading.Tasks.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Threading.Tasks.Parallel.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Threading.Tasks.Extensions.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Threading.Tasks.Dataflow.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Threading.Overlapped.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Threading.Channels.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Text.RegularExpressions.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Text.Json.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Text.Encodings.Web.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Text.Encoding.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Text.Encoding.Extensions.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Text.Encoding.CodePages.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.ServiceProcess.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.ServiceModel.Web.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Security.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Security.SecureString.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Security.Principal.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Security.Principal.Windows.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Security.Cryptography.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Security.Cryptography.X509Certificates.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Security.Cryptography.Primitives.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Security.Cryptography.OpenSsl.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Security.Cryptography.Encoding.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Security.Cryptography.Csp.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Security.Cryptography.Cng.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Security.Cryptography.Algorithms.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Security.Claims.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Security.AccessControl.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Runtime.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Runtime.Serialization.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Runtime.Serialization.Xml.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Runtime.Serialization.Primitives.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Runtime.Serialization.Json.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Runtime.Serialization.Formatters.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Runtime.Numerics.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Runtime.Loader.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Runtime.Intrinsics.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Runtime.InteropServices.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Runtime.InteropServices.RuntimeInformation.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Runtime.InteropServices.JavaScript.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Runtime.Handles.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Runtime.Extensions.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Runtime.CompilerServices.VisualC.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Runtime.CompilerServices.Unsafe.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Resources.Writer.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Resources.ResourceManager.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Resources.Reader.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Reflection.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Reflection.TypeExtensions.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Reflection.Primitives.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Reflection.Metadata.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Reflection.Extensions.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Reflection.Emit.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Reflection.Emit.Lightweight.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Reflection.Emit.ILGeneration.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Reflection.DispatchProxy.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Private.Xml.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Private.Xml.Linq.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Private.Uri.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Private.DataContractSerialization.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Private.CoreLib.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.ObjectModel.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\skins\akita_neru.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Numerics.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\skins\android.geo.json
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\skins\android.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Numerics.Vectors.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Net.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Net.WebSockets.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Net.WebSockets.Client.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Net.WebProxy.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Net.WebHeaderCollection.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Net.WebClient.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\skins\aria.geo.json
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\skins\aria.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Net.Sockets.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Net.ServicePoint.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Net.Security.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Net.Requests.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Net.Quic.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Net.Primitives.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Net.Ping.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Net.NetworkInformation.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Net.NameResolution.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Net.Mail.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Net.HttpListener.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Net.Http.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Net.Http.Json.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Memory.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Linq.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Linq.Queryable.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Linq.Parallel.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Linq.Expressions.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.IO.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.IO.UnmanagedMemoryStream.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.IO.Pipes.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.IO.Pipes.AccessControl.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.IO.Pipelines.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.IO.MemoryMappedFiles.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.IO.IsolatedStorage.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.IO.FileSystem.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\skins\baron.geo.json
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\skins\baron.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\skins\beardie.geo.json
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\skins\beardie.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\skins\cotton.geo.json
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\skins\cotton.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\skins\elise.geo.json
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\skins\elise.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\skins\goldenglow.geo.json
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\skins\goldenglow.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\skins\goose.geo.json
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\skins\goose.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\skins\kaltsit.geo.json
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\skins\kaltsit.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\skins\mikie.geo.json
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\skins\mikie.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\skins\miku.geo.json
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\skins\miku.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\skins\mothi.geo.json
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetics\skins\mothi.png
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.IO.FileSystem.Watcher.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.IO.FileSystem.Primitives.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.IO.FileSystem.DriveInfo.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.IO.FileSystem.AccessControl.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.IO.Compression.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.IO.Compression.ZipFile.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.IO.Compression.FileSystem.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.IO.Compression.Brotli.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Globalization.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Globalization.Extensions.dll
    		 EvoVisLauncher.exe pid 2444
    create
    C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Globalization.Calendars.dll
    		 EvoVisLauncher.exe pid 2444
    create
    Software\Microsoft\WBEM\CIMOM
    		 EvoVisLauncher.exe pid 2444
    create
    Software\Microsoft\MediaPlayer\Preferences\
    		 EvoVisLauncher.exe pid 2444
    create
    Software\Microsoft\MediaPlayer\Health\{C2668473-97F5-4B34-BB03-C24EB6C68806}
    		 EvoVisLauncher.exe pid 2444
    create
    Software\Microsoft\MediaPlayer\Preferences\ProxySettings\
    		 EvoVisLauncher.exe pid 2444
    create
    Software\Microsoft\Windows Media\WMSDK\General
    		 EvoVisLauncher.exe pid 2444
    create
    Software\Microsoft\Windows Media\WMSDK\Namespace
    		 EvoVisLauncher.exe pid 2444
    create
    SOFTWARE\Microsoft\Windows Media\WMSDK
    		 EvoVisLauncher.exe pid 2444
    create
    Software\Microsoft\MediaPlayer\Preferences\ProxySettings\HTTP
    		 EvoVisLauncher.exe pid 2444
    create
    \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SecurityProviders\WDigest
    		 EvoVisLauncher.exe pid 2444
    create
    Software\Microsoft\MediaPlayer\Preferences\ProxySettings\RTSP
    		 EvoVisLauncher.exe pid 2444
    create
    Software\Microsoft\MediaPlayer\Player\Tasks\NowPlaying\
    		 EvoVisLauncher.exe pid 2444
    create
    Software\Microsoft\RFC1156Agent\CurrentVersion\Parameters
    not the sample
    		 - pid 3192
    create
    SOFTWARE\Microsoft\CTF\CUAS\DefaultCompositionWindow
    		 EvoVisLauncher.exe pid 2444
    setvalue
    SOFTWARE\Microsoft\CTF\CUAS\DefaultCompositionWindow
    Left = 0
    		 EvoVisLauncher.exe pid 2444
    setvalue
    SOFTWARE\Microsoft\CTF\CUAS\DefaultCompositionWindow
    Top = 0
    		 EvoVisLauncher.exe pid 2444
    setvalue
    System\CurrentControlSet\Services\PptpMiniport
    DriverMajorVersion = 1
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\RasPppoe
    DriverMinorVersion = 0
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\wanarp
    Start = 2
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\ndproxy
    DriverMinorVersion = 0
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\wanarpv6
    NdisMajorVersion = 6
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\RasAgileVpn
    NdisMinorVersion = 30
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\NdisWan
    DriverMinorVersion = 1
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\PptpMiniport
    NdisMajorVersion = 6
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\RasPppoe
    NdisMajorVersion = 6
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\Rasl2tp
    DriverMajorVersion = 1
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\wanarpv6
    NdisMinorVersion = 84
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\ndproxy
    NdisMinorVersion = 30
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\NdisWan
    NdisMajorVersion = 6
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\wanarp
    NdisMajorVersion = 6
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\RasSstp
    DriverMinorVersion = 0
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\ndiswanlegacy
    NdisMajorVersion = 5
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\ndiswanlegacy
    NdisMinorVersion = 0
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\wanarp
    DriverMajorVersion = 0
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\NdisWan
    DriverMajorVersion = 1
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\RasAgileVpn
    NdisMajorVersion = 6
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\PptpMiniport
    NdisMinorVersion = 30
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\wanarpv6
    DriverMajorVersion = 0
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\NdisWan
    NdisMinorVersion = 30
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\wanarpv6
    DriverMinorVersion = 0
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\wanarp
    NdisMinorVersion = 84
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\RasPppoe
    NdisMinorVersion = 30
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\RasAgileVpn
    DriverMajorVersion = 1
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\Rasl2tp
    NdisMajorVersion = 6
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\RasSstp
    NdisMajorVersion = 6
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\RasAgileVpn
    DriverMinorVersion = 0
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\Rasl2tp
    DriverMinorVersion = 0
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\RasMan\Parameters
    MiniportsInstalled = 65535
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\RasMan
    Start = 2
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\Rasl2tp
    NdisMinorVersion = 30
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\RasSstp
    DriverMajorVersion = 1
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\RasPppoe
    DriverMajorVersion = 1
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\wanarp
    DriverMinorVersion = 0
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\RasMan
    DelayedAutostart = 0
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\PptpMiniport
    DriverMinorVersion = 0
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\RasSstp
    NdisMinorVersion = 30
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\ndproxy
    DriverMajorVersion = 1
    autostart diff
    		 -
    setvalue
    System\CurrentControlSet\Services\ndproxy
    NdisMajorVersion = 6
    autostart diff
    		 -
    setvalue
    Software\Microsoft\MediaPlayer\Preferences\
    ObfuscatedSyncPlaylistsPath = C:\Users\user\AppData\Local\Microsoft\Media Player\Sync Playlists\en-US\00003D66
    read back
    		 -
    setvalue
    Software\Microsoft\MediaPlayer\Preferences\
    OEMServiceOverride11 =
    read back
    		 -
    setvalue
    Software\Microsoft\Windows Media\WMSDK\General
    UniqueID = {105289A5-33D5-43EF-96E2-FF7C8B9B884E}
    read back
    		 -
    setvalue
    Software\Microsoft\Windows Media\WMSDK\General
    ComputerName = WORKSTATION
    read back
    		 -
    setvalue
    Software\Microsoft\Windows Media\WMSDK\General
    VolumeSerialNumber = -1475608248
    read back
    		 -
    setvalue
    Software\Microsoft\Windows Media\WMSDK\Namespace
    LocalBase = C:\Users\user\AppData\Local\Microsoft\Windows Media\12.2\WMSDKNS.XML
    read back
    		 -
    setvalue
    Software\Microsoft\Windows Media\WMSDK\Namespace
    DTDFile = C:\Users\user\AppData\Local\Microsoft\Windows Media\12.2\WMSDKNS.DTD
    read back
    		 -
    setvalue
    Software\Microsoft\Windows Media\WMSDK\Namespace
    LocalDelta = C:\Users\user\AppData\Local\Microsoft\Windows Media\12.2\WMSDKNSD.XML
    read back
    		 -

    External reputation was not produced for this scan. Threat intelligence enrichment is a paid-plan layer: every extracted indicator - hashes, addresses, hostnames - is checked against the external reputation services. Our own ingested feeds ran on this scan and every result below is theirs. Adding the paid layer adds an external reputation verdict on each indicator, so VirusTotal, MalwareBazaar and filescan.io are listed below as not checked. See plans.

    1 reported a hit 16 answered no 1 could not answer 5 had nothing to check
    1Sources with a hit
    18Sources queriedof 23 available
    470.3kFeed records
    1Could not answer

    File reputation

    4 clear · 3 not checked
    SourceChecksResultDetailFeed
    MalwareBazaar hash feed File hash clean not in feed 2,745 records
    40 minutes ago
    MalwareBazaar ransomware feed File hash clean not in feed 3,348 records
    5 hours ago
    ThreatFox hash IOCs File hash clean not in feed 1,158 records
    41 minutes ago
    URLhaus payload hashes File hash clean not in feed 1,642 records
    40 minutes ago
    filescan.io File hash not checked no hash lookup ran for this scan live lookup
    MalwareBazaar File hash not checked no hash lookup ran for this scan live lookup
    VirusTotal File hash not checked no hash lookup ran for this scan live lookup

    Hash lookups only - the sample itself is never uploaded to any third party.

    Network indicators

    7 clear · 1 could not answer
    SourceChecksResultDetailFeed
    URLhaus IP / domain / URL feed unavailable 8 observed indicators, none listed no records ingested
    blocklist.de IP / domain / URL clean 8 observed indicators, none listed 27.6k records
    40 minutes ago
    CINS Army IP / domain / URL clean 8 observed indicators, none listed 15k records
    41 minutes ago
    Emerging Threats IP / domain / URL clean 8 observed indicators, none listed 482 records
    41 minutes ago
    Feodo Tracker IP / domain / URL clean 8 observed indicators, none listed 5 records
    41 minutes ago
    IPsum IP / domain / URL clean 8 observed indicators, none listed 19.7k records
    41 minutes ago
    Phishing.Database IP / domain / URL clean 8 observed indicators, none listed 391.5k records
    0 minutes ago
    ThreatFox IP / domain / URL clean 8 observed indicators, none listed 1,158 records
    41 minutes ago

    TLS fingerprints

    nothing of this kind to check
    SourceChecksResultDetailFeed
    JA3 / JA4 fingerprint blocklists JA3 / JA4 not checked no TLS client fingerprint observed 97 records
    12 hours ago
    SSL blocklist Server certificate not checked no server certificate fingerprint is extracted to check live lookup

    Detection rules

    1 of 2 listed
    SourceChecksResultDetailFeed
    Signature rules Sample content 4 matches Suspicious_Anti_Debug_API, Embedded_PE_In_Overlay, COD3NYM_DOTNET_Sin… 110 records
    41 minutes ago
    Sigma rules Behavior log clean - 2,275 records
    7 hours ago

    Tooling catalogs

    4 clear
    SourceChecksResultDetailFeed
    LOLBAS Process image paths clean 1 process image path, none masqueraded 245 records
    41 minutes ago
    LOLBootloaders File hash clean not a known vulnerable bootloader 520 records
    40 minutes ago
    LOLDrivers File hash clean not a known vulnerable driver 2,333 records
    41 minutes ago
    LOLRMM Names and domains clean 5 name/domain indicators checked, no remote-management tooling 360 records
    40 minutes ago

    AI analysis

    The AI layer is a paid-plan feature. It reads what the other layers produced - the behaviour summary, the call sequence, the indicator list - and writes the narrative and the kill-chain walkthrough.

    Nothing is being withheld. This layer did not run for this scan, so there is no result stored behind the lock.

    See plans Create an account

    1 malicious 102 suspicious 0 info

    File indicators

    103
    SeverityTypeIndicatorDescription
    suspicious sample_sha256 a132e3137fb3a9686f510e279880fb4a452855de9bd221cdb48e1f1af7068c3f Submitted sample (SHA256)
    suspicious sample_md5 8338142d7085f4c6d3397f3e93278227 Submitted sample (MD5)
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\es\PresentationFramework.resources.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\es\PresentationCore.resources.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\WindowsBase.resources.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\UIAutomationTypes.resources.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\UIAutomationProvider.resources.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\runtimes\win-x64\native\WebView2Loader.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\UIAutomationClientSideProviders.resources.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\UIAutomationClient.resources.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\System.Xaml.resources.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\assets\viewer\cosmetic-thumbs.js Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\System.Windows.Input.Manipulations.resources.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\System.Windows.Controls.Ribbon.resources.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\ReachFramework.resources.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\PresentationUI.resources.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\PresentationFramework.resources.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\de\PresentationCore.resources.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\WindowsBase.resources.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\UIAutomationTypes.resources.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\UIAutomationProvider.resources.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\UIAutomationClientSideProviders.resources.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\UIAutomationClient.resources.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\System.Xaml.resources.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\System.Windows.Input.Manipulations.resources.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\System.Windows.Controls.Ribbon.resources.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\ReachFramework.resources.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\PresentationUI.resources.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\PresentationFramework.resources.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\cs\PresentationCore.resources.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\wpfgfx_cor3.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\vcruntime140_cor3.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationNative_cor3.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PenImc_cor3.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\D3DCompiler_47_cor3.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\WindowsBase.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\UIAutomationTypes.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\UIAutomationProvider.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\UIAutomationClientSideProviders.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\UIAutomationClient.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Xaml.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Windows.Presentation.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Windows.Input.Manipulations.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Windows.Extensions.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Windows.Controls.Ribbon.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Threading.AccessControl.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Security.Permissions.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Security.Cryptography.Xml.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Security.Cryptography.ProtectedData.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Security.Cryptography.Pkcs.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Resources.Extensions.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Printing.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.IO.Packaging.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Formats.Nrbf.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.DirectoryServices.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Diagnostics.PerformanceCounter.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Diagnostics.EventLog.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Diagnostics.EventLog.Messages.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Configuration.ConfigurationManager.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.CodeDom.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\ReachFramework.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationUI.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework.Royale.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework.Luna.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework.Fluent.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework.Classic.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework.AeroLite.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework.Aero2.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework.Aero.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework-SystemXmlLinq.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework-SystemXml.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework-SystemDrawing.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework-SystemData.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationFramework-SystemCore.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\PresentationCore.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\Microsoft.Win32.SystemEvents.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\Microsoft.Win32.Registry.AccessControl.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\DirectWriteForwarder.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\Accessibility.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\netstandard.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\mscorlib.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Xml.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Xml.XmlSerializer.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Xml.XmlDocument.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Xml.XPath.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Xml.XPath.XDocument.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Xml.XDocument.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Xml.Serialization.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Xml.ReaderWriter.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Xml.Linq.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Windows.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Web.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Web.HttpUtility.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.ValueTuple.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Transactions.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Transactions.Local.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Threading.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Threading.Timer.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Threading.ThreadPool.dll Executable written to disk during execution
    suspicious dropped_file C:\Users\user\AppData\Local\Temp\.net\EvoVisLauncher\98c\System.Threading.Thread.dll Executable written to disk during execution
    malicious imphash 8d0884146416cfc82b5a110c74a34ea5 Import table hash (imphash)

    Sigma detections

    0 matches of 2275 rules

    The Sigma corpus was evaluated against this run's processes, registry, file, network, DNS and script activity. Nothing matched.

    Generated rules

    Sigma: auto_file_2743_sigma_reg

    Auto-generated
    title: Auto-generated registry behavior rule (sandbox scan 2743)
id: sandbox-auto-2743-reg
status: experimental
description: Auto-generated from sandbox scan 2743
logsource:
    category: registry_event
    product: windows
detection:
    selection:
        TargetObject|contains:
            - 'Software\Microsoft\WBEM\CIMOM'
            - 'Software\Microsoft\MediaPlayer\Preferences\'
            - 'Software\Microsoft\MediaPlayer\Health\{C2668473-97F5-4B34-BB03-C24EB6C68806}'
            - 'Software\Microsoft\MediaPlayer\Preferences\ProxySettings\'
            - 'Software\Microsoft\Windows Media\WMSDK\General'
            - 'Software\Microsoft\Windows Media\WMSDK\Namespace'
            - 'SOFTWARE\Microsoft\Windows Media\WMSDK'
            - 'Software\Microsoft\MediaPlayer\Preferences\ProxySettings\HTTP'
    condition: selection
level: medium

    Extracted files

    What came out of the sample: unpacked payloads, carved objects and captured memory. Each one is stored by content hash, so the same object extracted twice is the same row.

    Artifacts

    1 file
    TypeNameSizeWhat it isSHA-256Download
    Extracted file embedded_pe_b5562d020cc2 1.3 MB PEno detection b5562d020cc2ad802d4995c17edbd36b215ec5b9463715cc6cea742ac8719cd1 ZIP

    Export & download

    /s/2743

    Structured exports for your SIEM/TIP - ATT&CK Navigator layer, STIX 2.1 bundle, MISP event and a defanged IOC list - are free on every report. The packet capture follows this scan's plan, because a capture is the rawest network output this platform produces.

    AI analysis report

    An enterprise report with an AI-written executive summary, threat assessment, kill chain, and recommendations, plus the derived evidence (verdict, MITRE ATT&CK, network, file modifications, dropped files, IOCs) and screenshots. The AI narrative is built from derived analysis data only, so the raw sample never leaves the host (no-upload and AI-boundary preserved).

    Public analyses of this file

    1 run
    SubmittedEnvironmentVerdictScore
    2026-10-13 18:08 Shown below Windows 10 22H2 Malicious 71/100